Fix for bug 98074: Attachment manager doesn't html_escape bug titles.

r1=caillon <mailto:caillon@returnzero.com>, r2=Jake
<mailto:jake@acutex.net>

diff --git a/template/default/attachment/edit.atml b/template/default/attachment/edit.atml
index 742822369b7eb40af65ad48d8531857b22f687a8..e1fc3e0353af3f64c87d97f5b11f9ed5e41effc9 100755 (executable)
--- a/template/default/attachment/edit.atml
+++ b/template/default/attachment/edit.atml
@@ -1,7 +1,12 @@
+[%# Define strings that will serve as the title and header of this page %]
+[% title = BLOCK %]Edit Attachment #[% attachid %] for Bug #[% bugid %][% END %]
+[% h1 = BLOCK %]Edit Attachment #[% attachid %] for <a href="show_bug.cgi?id=[% bugid %]">Bug #[% bugid %]</a>[% END %]
+[% h2 = BLOCK %][% bugsummary FILTER html %][% END %]
+
 [% INCLUDE global/header 
-  title = "Edit Attachment #$attachid for Bug #$bugid"
-  h1 = "Edit Attachment #$attachid for <a href=\"show_bug.cgi?id=$bugid\">Bug #$bugid</a>"
-  h2 = bugsummary
+  title = title
+  h1 = h1
+  h2 = h2
   style = "
     th { text-align: right; vertical-align: top; }
     td { text-align: left; vertical-align: top; }